Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.215 | 0,9 % |
| ≥10 % | 22.094 | 5,9 % |
| <10 % | 348.025 | 93,0 % |
CVE-2026-0546 | code-projects Content Management System 1.0 search.php value sql injection (EUVD-2026-0703)
A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This impacts an unknown function of the file search.php. This manipulation of the argument Value causes sql injection. This vulner
CVE-2025-51511 | Cadmium CMS 0.4.9 uploads unrestricted upload (Issue 23)
A vulnerability classified as critical has been found in Cadmium CMS 0.4.9. Affected is an unknown function of the file /admin/content/filemanager/uploads. Performing a manipulation results in unrestricted upload. This vulnerability is know
CVE-2025-50526 | Netgear EX8000 1.0.0.126 switch_status command injection
A vulnerability classified as critical has been found in Netgear EX8000 1.0.0.126. The impacted element is the function switch_status. This manipulation causes command injection. This vulnerability is handled as CVE-2025-50526. The attack c
CVE-2025-45493 | Netgear EX8000 1.0.0.126 action_bandwidth iface command injection
A vulnerability has been found in Netgear EX8000 1.0.0.126 and classified as critical. Affected by this vulnerability is the function action_bandwidth. The manipulation of the argument iface leads to command injection. This vulnerability is
CVE-2026-91512 | Oracle Agile Product Lifecycle Management for Process 6.2.4 Product Quality Management privileges management (EUVD-2026-106751)
A vulnerability labeled as problematic has been found in Oracle Agile Product Lifecycle Management for Process 6.2.4. This affects an unknown function of the component Product Quality Management. Such manipulation leads to improper privileg
CVE-2026-109956 | NLTK up to 3.10.3 WekaClassifier model_filename/model path traversal (EUVD-2026-98660)
A vulnerability was found in NLTK up to 3.10.3. It has been rated as critical. Affected is an unknown function of the component WekaClassifier. Performing a manipulation of the argument model_filename/model results in path traversal. This v
CVE-2026-91514 | Oracle BI Publisher 8.2.0.0.0/12.2.1.4.0/26.01.0.0.0 Web Server improper authorization (EUVD-2026-106752)
A vulnerability classified as problematic was found in Oracle BI Publisher 8.2.0.0.0/12.2.1.4.0/26.01.0.0.0. Affected by this issue is some unknown functionality of the component Web Server. The manipulation results in improper authorizatio
CVE-2026-116178 | vllm-project vLLM up to 0.29.x Multimodal Position Construction /inference/v1/generate resource consumption (EUVD-2026-109439)
A vulnerability was found in vllm-project vLLM up to 0.29.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /inference/v1/generate of the component Multimodal Position Construction. The ma
CVE-2026-116180 | vllm-project vLLM up to 0.30.x LogprobsTensors vllm/v1/outputs.py LogprobsTensors.empty_cpu missing initialization (EUVD-2026-109441)
A vulnerability classified as problematic has been found in vllm-project vLLM up to 0.30.x. The impacted element is the function LogprobsTensors.empty_cpu of the file vllm/v1/outputs.py of the component LogprobsTensors. The manipulation lea
CVE-2026-116157 | ImageMagick up to 7.1.2-32 PerlMagick memory leak (EUVD-2026-109418)
A vulnerability was found in ImageMagick. It has been rated as problematic. The affected element is an unknown function of the component PerlMagick. This manipulation causes memory leak. This vulnerability appears as CVE-2026-116157. The at
CVE-2026-116156 | ImageMagick up to 6.9.13-57/7.1.2-32 memory leak (EUVD-2026-109417)
A vulnerability labeled as problematic has been found in ImageMagick up to 6.9.13-57/7.1.2-32. The affected element is an unknown function. Such manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2026-116156
CVE-2026-116158 | ImageMagick up to 7.1.2-32 Compare memory leak (EUVD-2026-109419)
A vulnerability described as problematic has been identified in ImageMagick. This affects an unknown function of the component Compare. Executing a manipulation can lead to memory leak. The identification of this vulnerability is CVE-2026-1
CVE-2026-116173 | vllm-project vLLM up to 0.23.x Rust gRPC frontend output_logprobs/output_candidates.token_ids denial of service (EUVD-2026-109434)
A vulnerability marked as problematic has been reported in vllm-project vLLM up to 0.23.x. Affected is an unknown function of the component Rust gRPC frontend. The manipulation of the argument output_logprobs/output_candidates.token_ids lea
Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites
Hackers are now using public exploit code to break into websites that run PHP, and universities and business sites are among the main targets. The bugs behind this wave are two critical flaws in the PHP engine, tracked as CVE-2026-109618 an
CVE-2026-6032 | code-projects Simple Laundry System 1.0 /checkcheckout.php serviceId cross site scripting
A vulnerability classified as problematic has been found in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkcheckout.php. Performing a manipulation of the argument serviceId results in cross site
CVE-2026-6000 | code-projects Online Library Management System 1.0 SQL Database Backup File /sql/library.sql information disclosure
A vulnerability, which was classified as problematic, has been found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component SQL Database Backup File Handler. Perf
CVE-2026-5989 | Tenda F451 1.0.0.7 /goform/RouteStatic fromRouteStatic page stack-based overflow
A vulnerability was found in Tenda F451 1.0.0.7 and classified as critical. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. Thi
CVE-2026-5302 | CoolerControl coolercontrold up to 3.x cross-domain policy
A vulnerability identified as critical has been detected in CoolerControl coolercontrold up to 3.x. Affected by this issue is some unknown functionality. The manipulation leads to permissive cross-domain policy with untrusted domains. This
CVE-2026-5301 | CoolerControl coolercontrol-ui up to 3.x Log Viewer cross site scripting
A vulnerability marked as problematic has been reported in CoolerControl coolercontrol-ui up to 3.x. This vulnerability affects unknown code of the component Log Viewer. This manipulation causes cross site scripting. This vulnerability is t
CVE-2026-5300 | CoolerControl coolercontrold up to 3.x HTTP Request missing authentication
A vulnerability labeled as critical has been found in CoolerControl coolercontrold up to 3.x. This affects an unknown part of the component HTTP Request Handler. The manipulation results in missing authentication. This vulnerability is iden
CVE-2026-5208 | CoolerControl coolercontrold up to 3.x Alerts os command injection
A vulnerability described as critical has been identified in CoolerControl coolercontrold up to 3.x. This issue affects some unknown processing of the component Alerts. Such manipulation leads to os command injection. This vulnerability is
CVE-2026-40073 | sveltejs SvelteKit up to 2.57.0 BODY_SIZE_LIMIT allocation of resources (GHSA-2crg-3p73-43xp)
A vulnerability marked as problematic has been reported in sveltejs SvelteKit up to 2.57.0. The affected element is an unknown function. This manipulation of the argument BODY_SIZE_LIMIT causes allocation of resources. This vulnerability is
CVE-2026-39572 | magepeopleteam Bus Ticket Booking with Seat Reservation Plugin up to 5.6.5 on WordPress information expsure
A vulnerability identified as problematic has been detected in magepeopleteam Bus Ticket Booking with Seat Reservation Plugin up to 5.6.5 on WordPress. The impacted element is an unknown function. The manipulation leads to exposure of sensi
CVE-2026-34727 | go-vikunja up to 2.2.x OIDC Call improper authentication (GHSA-8jvc-mcx6-r4cg)
A vulnerability was found in go-vikunja vikunja up to 2.2.x and classified as critical. Affected by this vulnerability is an unknown functionality of the component OIDC Call Handler. Such manipulation leads to improper authentication. This
CVE-2026-116581 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create
CVE-2026-116580 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source
CVE-2025-13833 | A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate fingerprints, which allows the agent to accept and establish sessions with a malicious server. An attacker who controls the wired or wireless network can redirect traffic to a malicious server. The attacker can then use the agen
A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and the agent’s configuration file contains more than three trusted‑server entries. Some entries omit TLS certificate finge
CVE-2026-116504 | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to
CVE-2026-116579 | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame has been inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection, causing me
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output l
CVE-2026-116578 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location.
CVE-2026-116577 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the I
CVE-2026-116576 | systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString() in lib/util.js. On Windows, the sanitizer removes ASCII quotes but permits Unicode quotation marks that PowerShell accepts as string delimiters, allowing crafted input to terminate the filter and place a PowerShell e
systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellStr
CVE-2026-116502 | A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation o
CVE-2026-116575 | Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join call
CVE-2026-116671 | Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
Inside Node2Shell: A Closer Look at CVE-2026-111497
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Inside Node2Shell: A Closer Look at CVE-2026-111497 The post Inside Node2Shell: A Closer L
Hackers Exploit Critical Arista VeloCloud Orchestrator Flaw
Hackers exploit critical Arista VeloCloud flaw CVE-2026-114625. See CISA's Oct. 26 deadline, affected versions, and what security teams should check. This article has been indexed from eSecurityPlanet Read the original article: Hackers
CVE-2026-116482 | A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected r
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name l
CVE-2026-70382 | Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. Exploitation requires an attacker to influence a stored value and a user to view a page that renders it.
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views
CVE-2026-39564 | sunshinephotocart Sunshine Photo Cart Plugin up to 3.6.2 on WordPress insertion of sensitive information into sent data
A vulnerability has been found in sunshinephotocart Sunshine Photo Cart Plugin up to 3.6.2 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to insertion of sensitive in
CVE-2026-39526 | WpStream Plugin up to 4.11.2 on WordPress authorization
A vulnerability categorized as critical has been discovered in WpStream Plugin up to 4.11.2 on WordPress. This vulnerability affects unknown code. Such manipulation leads to authorization bypass. This vulnerability is traded as CVE-2026-395
CVE-2026-39506 | Jordy Meow AI Engine Plugin up to 3.4.2 on WordPress authorization
A vulnerability, which was classified as critical, was found in Jordy Meow AI Engine Plugin up to 3.4.2 on WordPress. Impacted is an unknown function. The manipulation results in missing authorization. This vulnerability is cataloged as CVE
CVE-2026-39484 | John Darrel Hide My WP Ghost Plugin up to 6.x on WordPress redirect
A vulnerability has been found in John Darrel Hide My WP Ghost Plugin up to 6.x on WordPress and classified as problematic. This vulnerability affects unknown code. The manipulation leads to open redirect. This vulnerability is documented a
CVE-2026-35167 | kedro-org kedro up to 1.2.x kedro/io/core.py _get_versioned_path path traversal (GHSA-6326-w46w-ppjw)
A vulnerability described as critical has been identified in kedro-org kedro up to 1.2.x. The impacted element is the function _get_versioned_path of the file kedro/io/core.py. The manipulation results in path traversal. This vulnerability
CVE-2026-23353 | Linux Kernel up to 6.19.6/7.0-rc2 ice libeth_rx_fq_create null pointer dereference (Nessus ID 303762 / WID-SEC-2026-0861)
A vulnerability was found in Linux Kernel up to 6.19.6/7.0-rc2 and classified as critical. This affects the function libeth_rx_fq_create of the component ice. Such manipulation leads to null pointer dereference. This vulnerability is unique
CVE-2026-65630 | Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (jose_jwa_x25
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar m
CVE-2026-65632 | The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 §3.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero b
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its ac
CVE-2026-65631 | Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API (or the Elixir wrappers JOSE.JWK.from_binary/1 and JOSE.JWK.from_map/1), an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters (p
Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the publi
CVE-2026-65629 | Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme
Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose export
CVE-2026-65628 | jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shared_secret(from(YourJWK), from(MyJWK)). Because from/1 returns an already-parsed jose_jwk record unchanged, passing two JWKs whose key types differ (for example an EC key and an RSA key) makes the fallback
jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-inv
CVE-2026-65627 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in
CVE-2026-57184 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser` permits an `out-of-bounds read` that may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled a
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `informa
CVE-2026-65626 | The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implemen
The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a paddi
CVE-2026-65625 | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1
CVE-2026-70381 | An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The acce
CVE-2026-57193 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configu
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter
CVE-2026-70380 | A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legitimate users from establishing MICE-based Miracast connections while the condition persists. Miracast P2P is not affected. MICE is disabled in the default configuration and must be explicitly enabled by t
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capaci
CVE-2026-116479 | A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated r
CVE-2026-108435 | Microsoft Office up to Office 365 for Mac Word null pointer dereference (EUVD-2026-102447)
A vulnerability marked as problematic has been reported in Microsoft Office up to Office 365 for Mac. This vulnerability affects unknown code of the component Word. This manipulation causes null pointer dereference. This vulnerability is tr
CVE-2026-108434 | Microsoft Office out-of-bounds (EUVD-2026-102446)
A vulnerability labeled as problematic has been found in Microsoft Office. This affects an unknown part. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-108434. The attack can be executed remotel